Delete an Extracted Field

You can delete extracted fields that are no longer needed.

vRealize Log Insight creates copies of the fields that you use when you create widgets, queries, or alerts. If you delete a field that is used in widgets, queries, or alerts, vRealize Log Insight creates a temporary copy of the deleted field for each widget, query, or alert that uses that field.

You can delete only fields that have the Edit this field icon next to their names. Administrators and users with edit access for the Explore Logs > Extracted Fields permission can delete their own content and their shared content. Other users can delete only their own content.

Content pack fields are read-only.

Prerequisites

Verify that you are logged in to the vRealize Log Insight web user interface as a user associated with the User role, or a role that has the relevant permissions. For more information, see Create and Modify Roles in Administering vRealize Log Insight. The URL format of the web user interface is https://log_insight-host, where log_insight-host is the IP address or host name of the vRealize Log Insight virtual appliance.

Procedure

1. Expand the main menu and click Explore Logs.
2. At the top of the Fields pane, click Manage extracted fields and hover over an extracted field from the list.
3. Click .
   A dialog box displays a list of content that uses the field that you want to delete. If you are an administrator user, and the field is shared by multiple users, the dialog box also displays a list of affected users.
4. Click Delete to confirm.

Results

If a deleted field is used in existing queries, vRealize Log Insight creates a temporary copy of the field and displays it when you load a query that uses the deleted field.

If you export content that contains temporary fields, vRealize Log Insight creates the fields in the exported content pack to avoid temporary fields.